A small number of functionality bugs and security problems in OpenSSL Project were deemed successfully rectified at the beginning of December 2015. The vulnerabilities, all deemed to be of moderate severity, were patched with new releases of the cryptographic resources.

There were three suspected flaws, assigned the certificate numbers CVE-2015-3193, CVE-2015-3194 and CVE-2015-3195, affecting versions 1.0.1 and 1.0.2 of OpenSSL.

CVE-2015-3193
The BN_mod_exp function was recently found to contain a bug which could mean it produced erroneous results under certain specific conditions. The vulnerability only affected a small number of algorithms, namely DSA, RSA and DH. Any attack against the the first two are thought to have only stood a vanishingly small likelihood of success. With DH, however, it was considered that the threat was real, although it would be extremely tricky to pull off as any key analysis would need very significant offline processing to stand any chance of success; the resources required would likely be available to only a very small number of potential hackers.

CVE-2015-3194
This certificate number relates to a vulnerability which may be exploited in a Denial of Service (DoS) attack. If an ASN accompanies a NULL pointer dereference during a certificate signature verification this can cause the application to crash. This complete failure of the module performing the verifying process can therefore be exploited, allowing a DoS attack to succeed.

CVE-2015-3195
A memory leak may occur in relation to the X509_ATTRIBUTE when this structure is formed incorrectly. Applications which process the CMS and PKCS#7 from untrusted sources are likely to be affected by this. It is noted that SSL/TLS were not compromised by this issue.